Qizheng Oasis

> 把 OASIS 三层架构（角色人格→社会演化→宏观涌现）融入七政体系。触发词：股票, A股, 基金, stock, skill, 优化。

Key issues to consider before installing: (1) The code will attempt to call a third-party LLM (SiliconFlow) and will look for a SILICONFLOW_API_KEY in /workspace/.credentials or the environment — but the skill's documentation claims no LLM/zero token usage. If you do not trust SiliconFlow or do not want workspace data sent externally, do not provide that API key. (2) The dashboard JS contains remote file-fetch URLs referencing workspace file paths; verify whether those endpoints are trustworthy and that no sensitive files (credentials, secrets, proprietary data) will be exposed. (3) If you need the simulator but want to avoid external calls, run the included rule-based scripts (run_blueberry.py, run_simulation.py, analyze.py) in an isolated environment and inspect/modify generate_profiles.py to disable the LLM branch (it already has a fallback rule-based generator). (4) Ask the author to clarify why an external LLM is used, to declare required env vars/config paths, and to document what data is sent off-host. (5) Prefer running this skill in an isolated/containerized workspace with no sensitive secrets mounted until you confirm its network behavior.

Type: OpenClaw Skill Name: qizheng-oasis Version: 1.0.0 The skill bundle provides a complex market and public opinion simulation engine. It is classified as suspicious primarily due to the inclusion of a large, unrelated 'iframe-highlight-injector' script in 'dashboard/index.html', which monitors user interactions (clicks, hovers, text content, and selectors) within iframes and reports them to the parent window. While this may be leftover code from a web-automation template, it represents a significant privacy risk and is not aligned with the stated purpose of market deduction. Additionally, multiple scripts (e.g., 'generate_profiles.py', 'run_simulation.py') access sensitive API credentials from '/workspace/.credentials/siliconflow-api.txt', which is a high-risk behavior, although it appears to be used legitimately for calling the SiliconFlow API.